65f1fe8049
Add sd_wifi.py -- operator tool for updating WiFi config on SD cards
...
Interactive and non-interactive CLI to detect, mount, and edit the
netplan 20-wifi.yaml on an armbi_root-labelled SD card without
needing to boot the implant.
2026-03-21 19:35:19 -04:00
187012e845
Add autostart.sh -- systemd service lifecycle management script
...
Enables/disables/reports status for bigbrother-core, bigbrother-capture,
and bigbrother-watchdog. Supports enable (enable+start), disable (stop+disable),
and status commands. Works locally on-device and over SSH from operator machine.
2026-03-21 19:34:14 -04:00
ba5143b560
Phase 4: Active modules, templates, and operator scripts
...
Active modules (9 files in modules/active/):
- bettercap_mgr: Central bettercap orchestrator with REST API health
monitoring, event stream parsing, crash recovery with corrective
gratuitous ARPs, caplet management, and process disguise
- arp_spoof: Thin bettercap wrapper for ARP spoofing with OPSEC warnings
- dns_poison: DNS poisoning with zone template loading support
- dhcp_spoof: DHCPv6 spoofing via bettercap for rogue DNS injection
- evil_twin: hostapd-based rogue AP with captive portal and dnsmasq,
iptables redirect, credential capture via HTTP POST handler
- ipv6_slaac: IPv6 SLAAC spoofing via bettercap + mitm6 WPAD abuse
- responder_mgr: Responder subprocess manager with hash file monitoring,
NTLMv1/v2 parsing, session log scanning, relay target coordination
- mitmproxy_mgr: Transparent proxy with addon scripts, tier checking
(OPi Zero 3+ only), iptables setup, credential/token extraction
- ntlm_relay: ntlmrelayx wrapper with multi-protocol relay (SMB, LDAP,
LDAPS, HTTP, MSSQL, ADCS), Responder exclusion coordination, SOCKS
Templates (9 files):
- 4 captive portals: corporate SSO, guest WiFi, Outlook/M365, VPN
(self-contained HTML with inline CSS, realistic login forms)
- 2 DNS zones: redirect-all and selective Jinja2 template
- 2 hostapd configs: open AP and WPA2-PSK Jinja2 templates
- 1 Responder.conf Jinja2 template with protocol toggles
Operator scripts (6 files in scripts/operator/):
- pull_data.sh: rsync structured data over WireGuard/Tailscale
- extract_files.sh: tshark HTTP/SMB/FTP/TFTP file extraction
- extract_print_jobs.sh: TCP/9100 print job reconstruction + PDF convert
- extract_emails.sh: SMTP email extraction with attachment detection
- crack_hashes.sh: Export creds to hashcat format, optional auto-crack
- generate_report.py: SQLite-to-Markdown/HTML engagement report generator
2026-03-18 13:48:11 -04:00
955ebfc8db
Add Phase 3 connectivity modules — 8 modules + bridge scripts
...
WireGuard (primary C2, PersistentKeepalive=0 for zero idle traffic),
Tailscale (fallback mesh VPN), Bridge (transparent inline L2 bridge with
802.1X bypass and ebtables protocol suppression), WiFiClient (WPA2-PSK
and WPA2-Enterprise via wpa_supplicant), ReverseTunnel (autossh over
stunnel/websocket — never raw SSH on 443), CellularBackup (LTE modem
via AT commands/mmcli, OPi Zero 3+ only), BLEEmergency (GATT server
with PSK auth for local last-resort access), DataExfil (priority-based
exfil with IMMEDIATE/NIGHTLY/ON_DEMAND tiers through connectivity chain).
Bridge scripts: setup_bridge.sh (create br0, disable STP, suppress
CDP/LLDP/BPDU via ebtables) and teardown_bridge.sh (safe cleanup).
2026-03-18 13:43:04 -04:00
f90a686626
Phase 1: setup script and data bootstrapping
...
- setup.sh: Idempotent bootstrap for OPi Zero 3 / RPi Zero 2W / Debian
Platform detection, system packages, Pi optimizations (gpu_mem, swap,
sysctl), directory structure, Python venv, bettercap binary install,
external tools (Responder, NetExec, Chisel, Ligolo, kerbrute, etc),
data database creation, systemd service install, permissions, verification.
Supports --reinstall, --jumpbox, --no-tools, --verify-only flags.
- scripts/build_data.py: Creates 5 SQLite databases
innocuous_macs.db (51 consumer device profiles with OUI/DHCP/TCP fingerprints),
oui.db (50 seed OUIs), os_sigs.db (16 p0f-style signatures),
dhcp_fingerprints.db (19 option-55 fingerprints), ja3_fingerprints.db (13 hashes)
- scripts/build_lkm.sh: LKM rootkit compiler wrapper
- scripts/rotate_pcap.sh: tcpdump post-rotation handler with zstd compression,
optional AES-256-GCM encryption, disk space monitoring, and auto-purge
2026-03-18 08:13:55 -04:00
62a1010ab4
Add Phase 1 utility modules: crypto, networking, logging, stealth, resource, permissions, config_loader, bettercap_api
...
9 files in utils/ providing the shared infrastructure layer:
- crypto: AES-256-GCM file encryption, argon2id/PBKDF2 key derivation, HKDF network unlock, LUKS container management
- networking: interface detection, MAC/IP helpers, BPF compilation via libpcap ctypes, gratuitous ARP, VLAN creation
- logging: encrypted log writer (BBLogger) with rotation, per-module files, stdout suppression for stealth
- stealth: process rename via prctl, cmdline spoofing, sysctl helpers, timestomping, core dump disable
- resource: hardware tier detection (OPi Zero 3 / Pi Zero / generic) via /proc/device-tree and cpuinfo, resource monitoring
- permissions: root/capability checks via capget ctypes, privilege dropping, directory permission enforcement
- config_loader: YAML merge hierarchy (hardware_tiers -> bigbrother -> modules -> stealth -> CLI), tier auto-detection, SIGHUP reload
- bettercap_api: REST client with per-session random credentials, session/events/command methods
2026-03-18 08:11:25 -04:00
n0mad1k